Unless it's a note like the DMs where the contents can only be decrypted by a certain key, notes are not private in and of themselves and most clients are designed to propagate notes to other relays when you interact with them. If one of those is a multiplexer relay it'll get blasted to a lot of relays.

I think there's a note type that is designed to stay private but it's not yet standardised or supported by clients or relays.